Changeset 32cc601 in Klonkt for .env.example

Timestamp:

06/14/2026 06:55:51 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

9e27d64

Parents:

ae924a2

Message:

auth: route Google login via central Klonkt broker (no credentials per instance)

The instance no longer talks directly to Google but delegates to the central
broker (license.klonkt.com): it performs the OAuth dance with one Google client
and returns a signed, audience-bound identity token, which we verify offline
against the broker's pubkey. This way no self-hoster needs to create their own
Google client.

• config/google.js: broker client (brokerStartUrl + verifyIdentityToken against /pubkey: issuer + EdDSA + audience==SITE_ORIGIN + typ; consumeJti against replay).
• routes/auth.js: /auth/google sets state in session -> broker; callback checks state (CSRF) + token + replay, finds-or-creates user on email.
• god only via ADMIN_EMAIL; the "first user becomes god" bootstrap only applies when NO ADMIN_EMAIL is set (otherwise a stranger on a fresh install could become owner).
• Reject login if the email address is already linked to a different google_sub.
• jose added to dependencies (verifier; otherwise npm ci crashes the app).
• .env: KLONKT_BROKER_URL + SITE_ORIGIN instead of GOOGLE_CLIENT_ID/SECRET.

Co-Authored-By: Claude <noreply@…>

File:

• .env.example (modified) (1 diff)

.env.example

@@ -5 +5 @@
 MEDIA_PATH=./storage/media
 
-# ── Google login (OAuth2) ──────────────────────────────────────────
-# Inloggen gaat volledig via Google. Maak een OAuth-client aan in de
-# Google Cloud Console (APIs & Services -> Credentials -> OAuth client ID,
-# type "Web application") en vul hieronder in. Zonder deze waarden boot de
-# app gewoon, maar toont de loginpagina "nog niet geconfigureerd".
-#
-# GOOGLE_REDIRECT_URI moet EXACT overeenkomen met een "Authorized redirect
-# URI" in de Google-client, en is per site het eigen domein + /auth/google/callback.
-GOOGLE_CLIENT_ID=
-GOOGLE_CLIENT_SECRET=
-GOOGLE_REDIRECT_URI=https://example.com/auth/google/callback
+# ── Google login via de Klonkt-broker ──────────────────────────────
+# Inloggen gaat via Google, maar gerouteerd door de centrale Klonkt-broker —
+# deze app maakt dus GEEN eigen Google-client aan. Je hoeft hier alleen de
+# broker-URL en het eigen publieke origin te zetten. Zonder deze waarden boot
+# de app gewoon en toont de loginpagina "nog niet geconfigureerd".
+KLONKT_BROKER_URL=https://license.klonkt.com
+# Het eigen publieke origin (scheme + host, geen pad/slash). Bepaalt de callback
+# (<SITE_ORIGIN>/auth/google/callback) en de audience die we eisen. Dit origin
+# moet in de KLONKT_ALLOWED_ORIGINS van de broker staan.
+SITE_ORIGIN=https://example.com
 
 # Het Google-e-mailadres dat owner/admin (god) is op deze instance.